{ "library_version": "0.3.0", "note": "Default classifications assume general office use by a deployer. Under the AI Act the risk class depends on the purpose of use, not on the tool alone. Not legal advice.", "purpose_rules": { "prohibited": [ "Emotion recognition of employees or students (except for medical or safety reasons)", "Social scoring of people", "Manipulative or exploitative techniques that cause significant harm", "Untargeted scraping of facial images to build face recognition databases", "Biometric categorisation inferring sensitive traits such as political views or sexual orientation" ], "high_risk_examples": [ "Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions", "Assessing creditworthiness or credit scores of individuals", "Deciding access to education or grading students", "Assessing eligibility for public benefits or essential services", "Risk assessment and pricing in life and health insurance", "Biometric identification of people" ], "limited_risk": "Chatbots and AI-generated content: people must be told they are dealing with AI, and published deepfakes or AI-written public-interest text must be labelled (Art. 50).", "minimal_risk": "Drafting, summarising, translation, coding help and similar general productivity use." }, "tools": { "Microsoft Copilot": { "kind": "Cloud AI assistant", "provider": "Microsoft (US)", "data_location": "Microsoft cloud; enterprise plans keep data under Microsoft's commercial data protection terms", "default_risk": "minimal", "gdpr_notes": "Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered." }, "ChatGPT": { "kind": "Cloud AI assistant", "provider": "OpenAI (US)", "data_location": "Provider cloud outside the EEA unless an EU data residency plan is used", "default_risk": "minimal", "gdpr_notes": "Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out." }, "Claude": { "kind": "Cloud AI assistant", "provider": "Anthropic (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44)." }, "Claude Code": { "kind": "AI coding assistant (command line)", "provider": "Anthropic (US)", "data_location": "Code and prompts sent to the provider's cloud", "default_risk": "minimal", "gdpr_notes": "Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories." }, "Gemini": { "kind": "Cloud AI assistant", "provider": "Google (US)", "data_location": "Provider cloud", "default_risk": "minimal", "gdpr_notes": "Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered." }, "Perplexity": { "kind": "Cloud AI search assistant", "provider": "Perplexity (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Needs an enterprise agreement and a transfer basis before work or personal data is entered." }, "Cursor": { "kind": "AI code editor", "provider": "Anysphere (US)", "data_location": "Code sent to the provider and its model providers unless privacy mode is enforced", "default_risk": "minimal", "gdpr_notes": "Enforce privacy mode through a business plan and sign a data processing agreement." }, "Windsurf": { "kind": "AI code editor", "provider": "US-based provider", "data_location": "Code sent to the provider's cloud", "default_risk": "minimal", "gdpr_notes": "Use a business plan with a data processing agreement and zero-retention settings." }, "Ollama": { "kind": "Local model runner", "provider": "Open source (runs locally)", "data_location": "On the device; nothing leaves unless a cloud model is selected", "default_risk": "minimal", "gdpr_notes": "No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network." }, "LM Studio": { "kind": "Local model runner", "provider": "Element Labs (runs locally)", "data_location": "On the device", "default_risk": "minimal", "gdpr_notes": "No transfer to a provider; check model licences and whether its local server is exposed." }, "GPT4All": { "kind": "Local model runner", "provider": "Nomic AI (runs locally)", "data_location": "On the device unless optional data sharing is enabled", "default_risk": "minimal", "gdpr_notes": "Keep the optional data lake sharing switched off." }, "Jan": { "kind": "Local model runner", "provider": "Open source (runs locally)", "data_location": "On the device unless a cloud model is connected", "default_risk": "minimal", "gdpr_notes": "Check whether remote API providers are configured; if so, the cloud provider rules apply." }, "Msty": { "kind": "Desktop AI client", "provider": "Desktop app (local and cloud models)", "data_location": "Local, or the cloud provider of any connected model", "default_risk": "minimal", "gdpr_notes": "Treat connected cloud models like the corresponding cloud assistant." }, "Alpaca (Ollama client)": { "kind": "Desktop client for local models", "provider": "Open source (runs locally)", "data_location": "On the device", "default_risk": "minimal", "gdpr_notes": "No transfer to a provider; check model licences." }, "Hugging Face models": { "kind": "Local model files", "provider": "Various model publishers", "data_location": "On the device", "default_risk": "minimal", "gdpr_notes": "Record which models are present and their licences; the risk class depends on what the models are used for." }, "Meta AI": { "kind": "Cloud AI assistant (built into WhatsApp, Instagram and Facebook apps)", "provider": "Meta (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Consumer service with no business data processing terms; do not share work or customer data in chats with Meta AI." }, "Grok": { "kind": "Cloud AI assistant", "provider": "xAI (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Consumer service; needs an enterprise agreement and a transfer basis before work or personal data is entered." }, "DeepSeek": { "kind": "Cloud AI assistant", "provider": "DeepSeek (China)", "data_location": "Provider cloud in the People's Republic of China", "default_risk": "minimal", "gdpr_notes": "No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data." }, "Character.AI": { "kind": "AI companion chatbot", "provider": "Character Technologies (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "limited", "gdpr_notes": "Consumer entertainment chatbot; not suitable for work use. Users must be told they are talking to an AI (AI Act Art. 50)." }, "Replika": { "kind": "AI companion chatbot", "provider": "Luka (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "limited", "gdpr_notes": "Consumer companion app that collects sensitive personal conversations and has been subject to EU data protection enforcement; not suitable for work use." }, "Otter": { "kind": "AI meeting transcription", "provider": "Otter.ai (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Records and transcribes other people's voices: needs a lawful basis and notice to meeting participants, plus a data processing agreement." }, "Grammarly": { "kind": "AI writing assistant (keyboard and browser)", "provider": "Grammarly (US)", "data_location": "Provider cloud outside the EEA", "default_risk": "minimal", "gdpr_notes": "Reads everything typed where it is enabled, including personal data; use the business plan with a data processing agreement or disable it in work apps." } } }